It should be mentioned that our method can be applied for certification of any model \(f(x)\) , i.e. it does not require changing the inference procedure as it is done in smoothing methods. However, if the model training is done in the standard way, the overall robust accuracy is expected to be significantly lower than the plain accuracy of the model. A straightforward way to improve the robustness of the model is to modify the training procedure. We can adapt the training procedure used in smoothing methods such as [1]}. Such procedure can be implemented through data augmentation: the model is trained on transformed samples, thus we expect it will have higher robust accuracy. During the inference stage, the smoothed model has to be evaluated many times [2]}, thus increasing the complexity. In our approach, we can apply the certification directly to the original model trained in an augmented way. Our numerical experiments confirm that such models typically have better accuracy, however, there are notable exceptions. This means that more research is needed in training more robust plain models and/or mixed approaches such as smoothing with a small number of samples.
